Law / United States / 
Pennsylvania
Privacy of Social Security Numbers Law: limits on posting, printing, transmitting and mailing Social Security numbers
74 P.S. § 201 (Act 60 of 2006)
In force since .
A sensitive categories rule binding public and private bodies.
- Obligation class
- Prohibition, Security
- Audit expectation
- none
As of .
What it requires
- Do not publicly post or publicly display an individual's Social Security number in any manner; to post or display means to intentionally communicate or otherwise make it available to the general public.
- Do not print an individual's Social Security number on any card required to access your products or services, or on materials mailed to the individual unless Federal or State law requires it. A number permitted in a mailing may not be printed, in whole or in part, on a postcard or other mailer that needs no envelope, or be visible on the envelope or without opening it.
- Do not require an individual to transmit a Social Security number over the Internet unless the connection is secure or the number is encrypted, or to use it to access an Internet website unless a password, unique personal identification number or other authentication device is also required.
- Do not disclose, except to the agency issuing the license, the Social Security number of an individual who applies for a recreational license under 30 Pa.C.S. (fish) or 34 Pa.C.S. (game).
- If you continue a use of Social Security numbers that began before the effective date and is inconsistent with these limits, make the use continuous, give each individual an annual disclosure of the right to stop it, and discontinue it within 30 days of a written request, at no fee and without denying services.
These lines are LexLint's reading of the law's text, as of .
If you get it wrong
Criminal exposureYes
Criminal exposure note
Section 1(g): a summary offense punishable by a fine of not less than $50 and not more than $500 and, for every second or subsequent violation, by a fine of not less than $500 and not more than $5,000.
Penalty structure
Section 1(g): a violation is a summary offense punishable by a fine of not less than $50 and not more than $500 and, for every second or subsequent violation, by a fine of not less than $500 and not more than $5,000. The $5,000 ceiling for a repeat violation is recorded as the per-violation amount; a first violation carries at most $500.
- Rule
- Per violation only
- As of
- Currency
- USD
- Per violation unit
- Violation
- Per violation amount
- 5,000
Who enforces it
Enforcement body
District attorneys of the several counties and the Pennsylvania Attorney General, who may investigate and institute criminal proceedings under section 2.
What this law does
Section 1(a) of the Privacy of Social Security Numbers Law provides that a person or entity or State agency or political subdivision shall not publicly post or publicly display in any manner an individual's Social Security number, print it on any card required for the individual to access products or services, require its transmission over the Internet unless the connection is secure or the number is encrypted, require its use to access an Internet website unless a password or other authentication device is also required, print it on materials mailed to the individual unless Federal or State law requires it, or disclose in any manner, except to the agency issuing the license, the Social Security number of an individual who applies for a recreational license.
Section 1(a)(5) bars printing an individual's Social Security number on any materials that are mailed to the individual unless Federal or State law requires the number to be on the document to be mailed. Section 1(c) lets an individual who receives the annual disclosure of a continuing prior use stop that use by written request, and requires the person or entity to discontinue the use within 30 days of receipt of the request, with no fee and no denial of services.
Section 1(g) deems a violation a summary offense punishable by a fine of not less than $50 and not more than $500 and, for every second or subsequent violation, by a fine of not less than $500 and not more than $5,000. Section 2 gives the district attorneys of the several counties and the Attorney General authority to investigate and to institute criminal proceedings for any violation of the act.
Section 4 provides that the act does not apply to a financial institution subject to Title V of the Gramm-Leach-Bliley Act or to a licensee as defined by the Insurance Department's privacy regulation, a covered entity under the federal health privacy rules, or an entity subject to the Fair Credit Reporting Act. Section 5 provides that the act takes effect in 180 days. The act is Act 60 of 2006, dated .
When LexLint raises it
When your app profile says your app crawls the web, trains models, deploys a chatbot or sends automated outreach.